Apple Fixes Hide My Email Vulnerability After 404 Media Coverage
Apple Patches "Hide My Email" Flaw Following 404 Media Report
For over a year, Apple was aware of a critical flaw within its Hide My Email service that inadvertently revealed the actual email addresses of its users. Despite this knowledge, the company only deployed a fix after the investigative outlet 404 Media published a report on the matter in early July.
The Core Issue
The vulnerability allowed virtually anyone to uncover the private email address that the "Hide My Email" feature was specifically designed to protect. This revelation comes amidst a class action lawsuit filed against Apple, alleging "deceptive conduct."
On Wednesday, Apple confirmed to 404 Media that a patch was released on July 3, which they claim has completely resolved the vulnerability.
What is "Hide My Email"?
This feature allows users to generate unique, anonymous aliases to avoid giving their real contact information to third-party websites or services.
- Format: Usually consists of
two random words+a number+@icloud.com. - Purpose: To prevent hackers from cross-referencing user activity across different data breaches.
Discovery and Timeline
The flaw was unearthed by Tyler Murphy, the co-founder of EasyOptOuts. During his initial investigation, Murphy noted a staggering success rate for the exploit:
"We don't know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email addresses were exploitable." — Tyler Murphy
The Cycle of Inaction
The interaction between Murphy and Apple followed a frustrating pattern:
| Phase | Action | Result |
|---|---|---|
| Initial Report | Murphy notifies Apple of the leak. | Apple claims to be investigating. |
| First "Fix" | Apple claims the issue is resolved. | Murphy proves it is still exploitable. |
| Second Report | Murphy notifies Apple again. | Apple claims to be investigating again. |
| Publicity | Murphy contacts 404 Media. | Apple finally deploys a working patch. |
Technical Breakdown
To protect users, 404 Media initially withheld the technical specifics of the exploit. Now that the patch is live, the mechanism can be revealed: the leak was triggered by sending a message to a target alias that was subsequently rejected as spam.
Vulnerability Flow
Example of a Leaked Log
If a server were to log the rejection, it might look like this in a simplified syslog format:
2026-07-01T10:00:01Z mail-server-01: REJECTED: <spam-filter>
From: attacker@example.com
To: random-words-123@icloud.com
Forwarded-To: ~~hidden-user~~ real-user@gmail.com
Remaining Risks and Legal Fallout
While the bug is active fixed, Murphy and co-founder Ben Weiner warn that the danger persists. Because many email hosts retain transfer logs, any account created before July 7, 2026, may have already been exposed.
Key Concerns:
- Vulnerability patched by Apple.
- Removal of leaked addresses from third-party logs.
- Resolution of the class action lawsuit.
The ongoing lawsuit seeks:
- Full reimbursement of subscription fees paid for the service.
- An injunction against Apple for misleading its customers.
About the Author
Joseph Cox is an award-winning investigative journalist. His reporting has led to the shutdown of tech firms and the imposition of fines totaling hundreds of millions of dollars.
Related Investigations by Joseph Cox
- Palantir & ICE: Just Futures Law is suing for documents regarding the
ELITEtech provided to ICE. - FBI & Signal: Apple fixed a bug allowing the FBI to recover deleted Signal messages from notification storage after 404 Media reported it.
- Thomson Reuters: Shareholders are demanding a probe into ICE contracts involving the
CLEARtool.
Other Recent Stories:
- Voting Rights & Olive Garden: Samantha Cole explores the link between unlimited pasta and ID laws.
- AI Training Data: Emanuel Maiberg reports on AI companies buying old books to avoid "AI slop."
- Drone Weaponization: Matthew Gault covers New Orleans police policies on weaponized drones.